exam questions

Exam SC-200 All Questions

View all questions & answers for the SC-200 exam

Exam SC-200 topic 3 question 13 discussion

Actual exam question from Microsoft's SC-200
Question #: 13
Topic #: 3
[All SC-200 Questions]

DRAG DROP -
Your company deploys Azure Sentinel.
You plan to delegate the administration of Azure Sentinel to various groups.
You need to delegate the following tasks:
✑ Create and run playbooks
✑ Create workbooks and analytic rules.
The solution must use the principle of least privilege.
Which role should you assign for each task? To answer, drag the appropriate roles to the correct tasks. Each role may be used once, more than once, or not at all.
You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Show Suggested Answer Hide Answer
Suggested Answer:
Reference:
https://docs.microsoft.com/en-us/azure/sentinel/roles

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Eltooth
Highly Voted 3 years ago
Correct - logic app contributor and sentinel contributor.
upvoted 9 times
...
Ramye
Most Recent 8 months, 1 week ago
Given answers are correct. But note: it's now called Microsoft Sentinel and not Azure Sentinel https://learn.microsoft.com/en-us/azure/sentinel/roles
upvoted 4 times
...
be9z
11 months, 2 weeks ago
Once you've assigned the "Logic App Contributor" role, the designated users or service principals will have the necessary permissions to create, modify, and run Logic Apps, including the Logic Apps associated with Azure Sentinel playbooks. Keep in mind that role assignments may take a few minutes to propagate.
upvoted 1 times
...
chepeerick
1 year ago
Correct, Logic app to playbooks
upvoted 2 times
...
ExamTopicsTST
1 year, 8 months ago
Answer is correct: https://learn.microsoft.com/en-us/azure/sentinel/roles#microsoft-sentinel-roles-permissions-and-allowed-actions
upvoted 4 times
...
Ramkid
1 year, 9 months ago
Given answers are (not) correct. Only Logic App Contributor role is allowed to create and edit the play books as per the link below https://learn.microsoft.com/en-us/azure/sentinel/roles#microsoft-sentinel-roles-permissions-and-allowed-actions The question is about the “Create and run playbooks”. Logic App contributor role is not sufficient to Run the play book. You need atleast “Microsoft Sentinel Playbook Operator” to run the play book as per the below link. https://learn.microsoft.com/en-us/azure/sentinel/roles#other-roles-and-permissions
upvoted 1 times
herta
1 year, 9 months ago
i think you are wrong based on this https://learn.microsoft.com/en-us/azure/sentinel/roles logic app contributor can view and run playbooks This table summarizes the Microsoft Sentinel roles and their allowed actions in Microsoft Sentinel.
upvoted 6 times
...
...
ACSC
1 year, 10 months ago
Answer is correct https://learn.microsoft.com/en-us/azure/sentinel/roles#other-roles-and-permissions
upvoted 3 times
...
amsioso
2 years, 1 month ago
https://docs.microsoft.com/en-us/azure/sentinel/roles#other-roles-and-permissions
upvoted 1 times
...
Fury
2 years, 2 months ago
https://docs.microsoft.com/en-us/azure/sentinel/roles Logic Apps Contributor - Attach playbooks to analytics and automation rules and run playbooks. Note: This role also allows users to modify playbooks. Logic apps contributor cannot be the right answer as it can't create playbooks. Sentinel contributor for both.
upvoted 2 times
...
prabhjot
2 years, 7 months ago
Playbook is nothing but Logic App ( so the ans is absolutely Correct )
upvoted 4 times
...
Andreew883
2 years, 9 months ago
Correct!
upvoted 1 times
...
NoNameP
3 years, 2 months ago
Correct!
upvoted 1 times
...
somsom
3 years, 2 months ago
correct
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago